Appeals Court Says Not Allowing Federal Officers To Pepper Spray Journalists Makes Law Enforcement Too Difficult

from the protecting-the-right-to-be-tear-gassed dept

The Ninth Circuit Appeals Court has just stripped away the protections granted to journalists and legal observers covering ongoing protests in Portland, Oregon. After journalists secured an agreement from local police to stop assaulting journalists and make them exempt from dispersal orders, the DHS's ad hoc riot control force (composed of CBP, ICE, and Federal Protective Services) showed up and started tossing people into unmarked vans and assaulting pretty much everyone, no matter what credentials they displayed. Shortly after that, a federal court in Oregon granted a restraining order forbidding federal agents from attacking journalists and observers.

Not that granting the restraining order did much to prevent federal officers from beating journalists with batons, spraying them with pepper spray, or making sure they weren't left out of any tear gassings. The plaintiffs were soon back in court seeking sanctions against federal violators of the order. The DHS said it couldn't identify any of the officers and stated it had punished no one for violating the order. This prompted the judge to add more stipulations to the order, including the wearing of identification numbers by officers engaging in riot control.

Unfortunately for journalists and legal observers, the restraining order is no longer in place. It was rolled back by the Appeals Court in a very short order [PDF] with the court finding that a blanket order protecting journalists and observers from being assaulted makes things too tough for federal cops. (via Courthouse News)

Based on our preliminary review, appellants have made a strong showing of likely success on the merits that the district court’s injunction exempting “Journalists” and “Legal Observers” from generally applicable dispersal orders is without adequate legal basis. Given the order’s breadth and lack of clarity, particularly in its non-exclusive indicia of who qualifies as “Journalists” and “Legal Observers,” appellants have also demonstrated that, in the absence of a stay, the order will cause irreparable harm to law enforcement efforts and personnel.

DHS personnel will still have to comply with the stipulation of the now dead restraining order requiring them to ID themselves:

This order does not disturb the portion of the district court’s August 20, 2020 order directing the parties to confer regarding identifying markings…

The equally short dissent disagrees. The restraining order has been in place for more than a month at this point and the federal task force hasn't found itself unable to engage in crowd control and riot suppression efforts.

In light of the deferential review accorded to the district court’s factual finding at this stage, the district court’s extensive factual findings with respect to journalists and legal observers, including the finding that the injunction would not impair law enforcement operations to protect federal property and personnel, and the fact that a temporary restraining order has been in place since July 23, 2020, the government has failed to meet its burden to demonstrate either an emergency or irreparable harm to support an immediate administrative stay.

This will be appealed. And it may end up being something the Supreme Court will feel like addressing. There's a question that needs to be answered since the future will contain plenty of protests and plenty of people covering them. This was how the district court judge explained it in an earlier hearing:

Simon initially said at a hearing Tuesday that the question of whether journalists have different rights under the First Amendment than those of protesters, who legally must leave an area after a riot has been declared, was likely to end up before the U.S. Supreme Court.

But Judge Simon took a pass on that question in his decision -- the one now rejected by the Appeals Court.

Someday, a court may need to decide whether the First Amendment protects journalists and authorized legal observers, as distinct from the public generally, from having to comply with an otherwise lawful order to disperse from city streets when journalists and legal observers seek to observe, document, and report the conduct of law enforcement personnel; but today is not that day.

With this rejection by the Appeals Court, that "someday" may be much closer than it was a little more than a week ago, when journalists and observers were still shielded from being assaulted by federal officers. The gloves are off now and federal agents are free to treat them like the rest of the crowd when deploying force.

Filed Under: 9th circuit, dhs, due process, journalists, portland, protests, restraining order

Exaggerated Claims And Out Of Context Tweets Used By Political Hopeful To Slap Restraining Order On Critic

from the free-speech? dept

We've written plenty of times about the chilling effects of abusing the legal system to silence critics. Most commonly, we highlight bogus defamation cases -- as that seems to be the favored choice of those trying to shut someone up. Sometimes we've talked about abusing copyright law to silence people as well. But there are other mechanisms to use, and today we'll be highlighting a local political fight in California that resulted in someone getting a "temporary restraining order" on a critic which was clearly little more than an attempt to silence that critic from calling attention to factual information in the past.

The story involves two individuals who were engaged in local politics in Santa Clarita, California. One is a guy named Sean Weber, who sought an open City Council seat earlier this year. The other is a guy named Brett Haddock, who also initially sought the same open City Council seat... and also happens to run a very amusing satirical Twitter account, @NSA_PR in which (you guessed it), he channels the satiric id of the NSA's public relations team. (Full disclosure: I've interacted with that Twitter account a bunch online, and I believe that Haddock has purchased some of our t-shirts and backed some of our crowdfunding campaigns, though I haven't gone back to check -- so feel free to read this story with all of that in mind). Neither Weber nor Haddock obtained the open seat.

Either way, Haddock and Weber did not see eye to eye on things. The full nature of the dispute isn't all that important, but for one key aspect. In running for City Council, during a radio interview, Weber made two key claims that Haddock felt were misleading. The first was that he volunteered at a local homeless shelter and the second was that he had been working with a local school district on an "active shooter" response system. Haddock, in response, posted a blog post detailing why both of these points were misleading.

There are lots of details in Haddock's post, but the very quick summary is that the "volunteering" at a local homeless shelter was actually 192 hours of mandatory community service as part of his probation after being arrested for "dissuading a witness by force or threat." So, yeah. He worked at a homeless shelter, but it's a bit rich to hold that upt as "volunteering."

As for the "active shooter" stuff, Haddock points out that it appears that Weber, as part of his job running a "managed service provider," approached the school about selling them on some communications services that might be useful in emergencies. In an email that Haddock obtained from school district officials, it was noted that Weber "cold called" them in trying to sell them some services and the school met with him a few times, and were told that Weber would submit a proposal, which the official does not believe ever came. Whether or not you consider Weber's claims in a radio interview to have met with the school to discuss such a system or to "provide guidance" on such a system to be accurate or not is a matter of your opinion. It certainly does seem that the fact that this was as a sales cold call provides some useful additional context that Weber was less than clear on.

All in all this doesn't seem like a big deal. This is Haddock using his Constitutional right of expression to add potentially valuable context to statements made by an individual seeking public office. As you might guess, however, Weber did not appreciate Haddock's blog post, or similar questions that Haddock had raised elsewhere. Haddock and Weber both appear to have participated, sometimes vehemently, in online discussions in a Facebook group, where Haddock felt that Weber was rude and threatening to other members of the group. At one point, the two engaged in a Facebook messaging conversation that appears -- at least -- to initiate with Haddock and Weber totally misunderstanding each other over the use of the common phrase "have you stopped beating your wife?", and rather than resolving the misunderstanding things escalate (as they often do in online conversations). And, boy, do they escalate, with each one promising to leave the conversation multiple times only to see it continue. A few times Weber makes insinuations about Haddock's girlfriend, while Haddock refers to Weber as a "con man." Neither is pleased with what the other is saying. Weber continues to escalate, though, and threatens to inform Haddock's employer about this... and, eventually, reacts the way lots of online bullies act when they get annoyed: with veiled threats of potential legal action (he talks about "tortious interference" and "punitive damages" but also says "not going to sue you as you don't have any assets and it's not my style.")

If you've engaged in internet fights, it's not all that different than probably tons you've seen before. That all came a few weeks before Haddock's blog post described above. Immediately after that blog post, Weber filed for a restraining order. That... doesn't make much sense. All there had been was some heated online discussions and a blog post that was clearly protected speech. Yet, in the paperwork for the restraining order, Weber's lawyer said that Haddock had engaged in "a persistent pattern of online 'cyber' harassment that has been increasing in volume and a harassing course of action, including but not limited to posting of the private home address and telephone numbers." It also claims that "the tone and volume of the messages have increased to the point where Petitioner is fearful for his safety and that of his family."

As you look through the details most of this is not at all true. It does appear that they had that conversation on Facebook a few weeks earlier, but after that all conversation ceased. The issue of posting "home address and telephone numbers" was apparently a missed redaction in some of the court documents that Haddock posted as evidence. A family member of Weber's asked Haddock to fix and Haddock noted that he had redacted the info and asked politely if any information that should have been redacted had been missed... and never heard back. Weber's restraining order request claims that Haddock ignored the requests which does not appear to be true.

Even more ridiculous, Weber and his lawyer present a worker's comp situation that Haddock is engaged with concerning his current employer as evidence that Haddock has psychological problems. That's based on part of the worker's comp claim where Haddock's claim noted he has been having difficulty sleeping due to a back injury after his office chair broke.

Finally, after Haddock and his lawyer responded, pointing all this out, rather than prove the supposed increasing cyber harassment, Weber's lawyer filed a truly bizarre response, that is the legal equivalent of "look, squirrel!" Rather than showing the supposed cyber harassment, the brief completely pivots and mostly focuses on combing through Haddock's social media feeds and taking random tweets (usually joke tweets) completely out of context to suggest that Haddock is somehow mentally unstable and therefore dangerous. When put back into context it's quite clear that nothing of the sort is true.

The use of the tweets is particularly ridiculous. Some are obvious jokes. Some are devoid of context, such as this one:

Beyond the fact that this is from two years ago (well before this dispute happened) and beyond the fact that it's just a general exasperated statement using a Futurama meme, Weber's lawyer ignores that YouTube link. What is it? It's a twerking stuffed dog. Haddock isn't suggesting that he's going to kill himself or do damage. He's mocking the fact that a twerking stuffed dog is the end of civilization. How that could possibly be evidence of either mental instability or "harassment" requiring a restraining order is beyond me. Over and over again, the tweets being used as evidence against Haddock are merely jokes or wry commentary on totally unrelated issues (bizarrely, a few of the tweets actually involve a wholly unrelated issue loosely involving Techdirt and someone who was very angry at one of our own stories).

Here's another example, where Weber's filing takes things totally out of context. Weber's filing shows the following two tweets as supposed evidence of Haddock being "disposed to erratic (and possibly violent) behavior":

Even without context, neither of these tweets appear to be all that damning. They appear to be someone obviously venting frustration online in a hyperbolic manner, but with zero evidence of being "erratic" or disposed to violent behavior. But let's put them back into context. If you looked at the full thread around Haddock's statements, he's talking about the frustration (one many people have experienced) of dealing with the bureaucratic mess involving the insurance company and his worker's comp claim:

This is all... pretty terrible. And, it gets worse: the court granted the restraining order. At the last minute, Haddock brought in Ken "Popehat" White to handle the hearing, and White got the judge to say that Haddock can still blog about Weber, but there's now a two year restraining order on Haddock saying that he needs to remain physically separate from Weber, keeping a distance of at least 100 yards in most cases, reduced to 20 yards at public gatherings.

Haddock and White have both made it clear that they are going to appeal this restraining order, which Haddock has argued effectively makes it impossible for him to engage in local political issues, as he's done for years. The whole thing appears to be a clear attempt to stifle free speech through legal process. It's difficult to see anything that Haddock has done that reaches a level of harassment or "stalking" that requires a temporary restraining order, and because of that his own speech is at the very least chilled.

Filed Under: brett haddock, chilling effects, first amendment, free speech, restraining order, santa clarita, sean weber, social media, tro

Whatever You Think Of The RIAA's Lawsuit Over Aurous, Shouldn't We Be Concerned That It's Pretending SOPA Is Law?

from the seems-like-an-issue-that-ought-to-be-looked-at dept

As you may have heard, earlier this week, the RIAA sued Aurous and its creator Andrew Sampson for creating an apparently easy to use software front-end for streaming music from some unauthorized repositories (mostly in Russia). For his part, Sampson insists that he just used some publicly available APIs and created a nice front end, without doing anything that is directly infringing himself. While I can understand those claims, the existing details and case law suggest that Sampson isn't going to fare very well in court. Given Sampson's own public statements, at the very least, the RIAA has made a fairly compelling case under the Grokster "inducement" theory. You can -- as I do -- think that "inducement" to copyright infringement is a ridiculous thing to be considered against the law, but that doesn't change the fact that it is, indeed, the law. Unless there are some as yet unknown details here, Sampson is likely going to have a hard time getting around the inducement claims.

So given all that, I fully expect that Sampson will lose the lawsuit (and lose easily) if the case gets that far. However, that doesn't mean that parts of the lawsuit aren't concerning. Of particular concern is what the RIAA is asking for in the lawsuit -- and what the judge appears to have granted. Specifically, in the lawsuit itself, the RIAA doesn't just ask for Aurous to be shut down, but also asks for all sorts of third parties to be restrained as well. Here's the list of things the RIAA asks the court to issue an order for:

(A) enjoining Defendants and all third parties with notice of the Order, including any Web hosts, domain name registrars, domain name registries, or their administrators, from facilitating access to any or all domain names, URLs, and websites (including, without limitation, www.aurous.me) through which Defendants infringe Plaintiffs’ copyrights;

(B) requiring domain name registries and/or registrars holding or listing Defendants’ domain names and websites (including, without limitation, www.aurous.me) through which Defendants infringe Plaintiffs’ copyrights to: (a) disable www.aurous.me and any related domain names specified by Plaintiffs through a registry hold or otherwise, and to make them inactive and non-transferable, and (b) transfer Defendants’ domain names to a registrar to be appointed by Plaintiffs to re-register the domain names in Plaintiffs’ names and under Plaintiffs’ ownership;

(C) enjoining all third parties with notice of the Order from maintaining, operating, or providing advertising, financial, technical, or other support to Defendants and any other domain names, URLs or websites through which Defendants infringe Plaintiffs’ copyrights, including without limitation www.aurous.me; and

(D) enjoining all third-party distributors of applications, toolbars, or similar software with notice of the Order from distributing any applications, toolbars, or similar software applications that interoperate with any domain names, URLs or websites through which Defendants infringe Plaintiffs’ copyrights, including without limitation www.aurous.me.

This is problematic, to say the least. Remember, SOPA did not become law, and yet the main part of the original SOPA bill was to create just this sort of remedy, whereby copyright providers could get a court order to get third party companies to be barred from doing any business at all with a site deemed a "pirate" site. Yet, SOPA did not become the law and the RIAA is just pretending it is law in asking the court to block all of those third parties from providing any services to the site.

The RIAA also submitted a desired temporary restraining order, which the judge effectively rubber stamped, granting everything the RIAA asked for -- but rejecting the RIAA's request not to have to put up a bond over this. Instead, the judge ordered the RIAA to put up a tiny $5,000 bond in case a party was "wrongfully" enjoined. That temporary restraining order seems pretty broad as well:

... Defendants and their officers, agents, servants, employees, attorneys, and all persons who in active concert or participation with each or any of them, or who are aiding and abetting their conduct, are hereby RESTRAINED and ENJOINED until further Order of this Court from infringing, or causing, enabling, facilitating, encouraging, promoting and inducing or participating in the infringement of, any of Plaintiffs’ copyrights protected by the Copyright Act, whether now in existence or hereafter created...

Of course, one might question what qualifies as "all persons who are in active concert or participation," but it still has the potential to be overbroad, and to pull in all sorts of third parties who are doing nothing more than providing basic services.

Again, none of this is to say that Aurous is legal or shouldn't be facing this lawsuit. But pulling in third parties here was exactly the kind of thing that Congress chose not to do when it did not pass SOPA, in the wake of overwhelming public sentiment against allowing these sorts of remedies.

So why is the RIAA simply acting like it got what it wanted with SOPA and asking the court to proceed accordingly?

Filed Under: andrew sampson, copyright, dmca, inducement, intermediary liability, lawsuit, restraining order, sopa, third parties
Companies: auroros, riaa

Court Realizes That Maybe It Can't Order Cloudflare To Proactively Block Any New Grooveshark From Ever Appearing

from the that's-not-how-this-works dept

After Grooveshark shut down a few months ago, some individuals set up a site that looked kind of like Grooveshark, but with a totally different backend, and used a variety of URLs that included Grooveshark on different top level domain systems. The RIAA, as it's been known to do, freaked out, and filed a lawsuit. As part of this, it sought a restraining order and injunction, which it got. The RIAA then insisted that the restraining order applied to CDN provider Cloudflare, despite not actually being a part of the case. Cloudflare, as a non-party worried about the impact of such a restraining order, stepped into the case to protest, but the judge still ruled against Cloudflare despite the fact that the ridiculously broad injunction went really far, basically saying that no site with the word "Grooveshark" in the domain could use Cloudflare, even if that was a domain like "GroovesharkSucks-GoBuyMusic.com."

Cloudflare complied, but asked the court to modify the ridiculously overbroad injunction, as it could easily be read to say that Cloudflare itself then had to proactively police every use of its service to make sure no one tried to similarly post a Grooveshark-related site. Instead, it asked the judge to, at the very least, require the RIAA to alert Cloudflare to sites that it believed were violating the injunction. The RIAA, of course, argued that Cloudflare had the full responsibility of proactively making sure no new Groovesharks showed up. The judge has now clarified the original injunction, saying that, yes, the RIAA needs to alert Cloudflare to any future problematic sites, but denying Cloudflare's request for a five day turnaround time.

The initial injunction still seems tremendously problematic in just how broad it is. Here's what it covers, saying that basically anyone is barred from:

1. Using the Grooveshark Marks in any manner in connection with the advertising, offering for sale, or sale of any service or product, not provided by or authorized by Plaintiff UMG.
2. Committing any acts calculated to cause consumers to believe that the Counterfeit Service or any other use of the Grooveshark Marks is offered under the control and supervision of Plaintiff UMG or sponsored or approved by, or connected with, or guaranteed by, or produced under the control and supervision of Plaintiff
3. Infringing any of the Grooveshark Marks and damaging Plaintiff goodwill;
4. Otherwise competing unfairly with Plaintiff UMG in any manner; or
5. Using, linking to, transferring, selling, exercising control over, or otherwise owning the domain names grooveshark.io or groovesharkpw or any other domain name that incorporates, in whole or in part, any of Grooveshark Marks (the "Infringing Domain Names").
6. Directly or secondarily infringing Plaintiffs' copyrighted sound recordings via the Counterfeit Service or any variations thereof.

While I don't care what happens to Grooveshark itself or these copyrights, it seems quite disturbing that a judge can issue such a broad injunction that can impact so many third parties, potentially making them liable should someone do something that "unfairly competes with Universal Music in any manner." Part of the point of SOPA was to add these kinds of injunctions to the law but Congress did not approve SOPA. So why is the court acting like it has this power?

Again, it's easy to say "meh, no big deal, whoever set up these sites were clearly infringing" or even to attack them for setting up a fake Grooveshark. But this goes beyond that, and raises serious questions about the court's powers to order third parties to block all access to websites without full due process.

Filed Under: injunction, restraining order, site blocking
Companies: cloudflare, grooveshark, riaa

Court Issues Highly Questionable Restraining Order Over Anyone Even Remotely Related To Streaming Mayweather/Pacquiao Fight

from the that's-not-right... dept

Last week, we wrote about HBO and Showtime teaming up to pre-emptively sue two websites that publicly claimed they were going to live stream video footage of the Floyd Mayweather/Manny Pacquiao boxing match that happened this weekend. As we noted, it seemed odd to sue someone for infringement prior to the copyrighted content even existing, but as some helpfully noted, US copyright law includes a weird provision, 17 USC 411(c), which notes that when you're talking about works where "the first fixation of which is made simultaneously with its transmission," then "the copyright owner may, either before or after such fixation takes place, institute an action for infringement" given a few, pretty basic, conditions. In other words, while rare, the law does allow for just that sort of lawsuit for anticipatory infringement.

Thus, it shouldn't be too surprising that the judge, in fact, granted the request for a temporary restraining order on the two sites in question, boxinghd.net and sportship.org. Frankly, I have no idea if either one of the sites carried through on their promise to stream the fight this weekend, though I imagine it would be fairly dumb of them to have actually done so. From a cursory check, as I type this, it appears both sites are completely offline, so perhaps they both just shut down rather than deal with the threats from HBO and Showtime (or, perhaps, just moved to alternate domains).

However, as EFF points out, the court's temporary restraining order issued in the case goes way, way beyond just restricting those two sites, and raises some really serious concerns. Specifically, the restraining order didn't just restrict those two sites from showing the streams of the boxing match, but basically anyone who is sent the order:

Each and every one of the Defendants and their agents, servants, employees, officers, attorneys, successors, licensees, partners, and assigns and all those acting in active concert or participation with any of them, including any and all service providers who receive notice of this Order, are temporarily restrained and enjoined...

As the EFF points out, this is de facto SOPA -- allowing copyright holders to simply point at a site they don't like, claim they're "bad" and basically order them off of the internet by merely sending a copy of the restraining order:

You may not feel much sympathy for the websites in question. But this kind of site-blocking, without real legal process, is essentially one of the worst parts of the ill-conceived, long-dead Stop Online Piracy Act (SOPA) being brought in through the courtroom back door. HBO got an order to block content against those who act as intermediaries, even though they have nothing to do with the alleged illegality of the sites, are simply providing normal business services, and almost surely had no notice that they were about to be enjoined.

This is not the way our legal system is meant to work, and the good news is that it actually doesn’t. Federal Rules only allow courts to issue injunctions against those who truly are in “active concert or participation” with bad actors. We doubt that those who offer hosting services and video delivery, without more, can properly be considered in “active concert or participation” with the unauthorized streamers.

As the article above points out, it may not seem all that sympathetic considering these kinds of sites, but take it a step further. As we already discussed, whether or not these sites actually streamed any parts of the fight, the fight was widely streamed -- but via Twitter's Periscope service. And, under the terms of this order, if HBO or Showtime had sent this order to Twitter, it could be found to have violated a court order despite not even remotely being a party to the case!

I don't care what you think about those who might have streamed the fight in an unauthorized way, you have to admit that there are clear due process concerns when a court pushes such a broad order, that ties the hands of those who might not even have been aware of the court case at all, let alone that it was legally restricting their ability to operate (in a way that might also be technically impossible). Yes, this may have been convenient for HBO and Showtime, but it's difficult to see how that temporary restraining order is even remotely constitutional (or sensible).

Filed Under: due process, floyd mayweather, free speech, lawsuits, manny pacquaio, restraining order, streaming
Companies: hbo, showtime, twitter

First Conviction Using California's Revenge Porn Law

from the for-one-horrible-ex-boyfriend dept

Just as Arizona's anti-revenge porn law has been put on hold due to First Amendment concerns, California prosecutors have scored their first conviction under California's recently enacted revenge porn law. The guy, Noe Iniguez, sounds particularly horrible:

Iniguez, using an alias, allegedly began posting derogatory comments about his ex-girlfriend on her employer’s Facebook page. In March, 2014 Iniguez allegedly posted a topless photograph of the victim on her employer’s Facebook page which was accompanied by a message that called the victim a “drunk” and a “slut” and encouraged her firing from the company.

The court gave him a year in jail. However, again, it appears that existing laws would have been perfectly fine for going after this guy. The reports say that he ignored two separate restraining orders and the jury had found him guilty of such. The revenge porn law just seems like a way of adding even more charges, and prosecutors recognize that, as the following statement came from LA City Attorney Mike Feuer:

California’s new revenge porn law gives prosecutors a valuable tool to protect victims whose lives and reputations have been upended by a person they once trusted. This conviction sends a strong message that this type of malicious behavior will not be tolerated.

There's no doubt that the actions taken by Iniguez were horrible. I totally get the desire to put him away -- but, again, it appears that existing laws were perfectly adequate in dealing with the situation. The problem is that these kinds of revenge porn laws open up the ability to potentially go after people for First Amendment protected speech, and that should be a serious concern.

Filed Under: california, mike feuer, noe iniguez, restraining order, revenge porn

Google Plus Invite Results In Man's Arrest For Violating A Restraining Order

from the requesting-permission-to-post-on-your-behalf,-jailbird dept

To many people, Google's social media platform, Google+, remains a conundrum. Is it a Facebook competitor? Is it Google's efficient way of consolidating its power disparate services into a cohesive whole? Is it an ASCII penis generator?

One thing it might be is a brand new way to get in trouble. Matthew A. Sawtell sends in this story of one man whose dip into Google's social media pool resulted in his arrest.

Prosecutors say Thomas Gagnon violated a restraining order by sending his former girlfriend an invitation to join his Google Plus circle.

But Gagnon’s attorney says his client has no idea how the woman he once planned to marry — popping the question with a $4,000 ring earlier this month — got such an invitation, suggesting that it might have been sent by a robot.

Gagnon's attorney may not be far off. If Gagnon's estranged ex used other Google services like Gmail to communicate with Gagnon back in happier days, there's a good chance she was inserted into a list of potential Google+ "friends*" in order to easily insert them into Circles.

Then again, how Google generates its suggested contacts is considered a black art by much of the population, although the prevailing notion is that if Google owns it and you use it, you're on the list. The judge presiding over Gagnon's somewhat unexpected appearance in court had this bit of insight on the social media platform.

A Salem District Court judge yesterday admitted he wasn’t sure exactly how such invitations work on Google’s social media site…

That didn't stop him from setting Gagnon's bail at $500 and ordering him to stay away from his ex-girlfriend.

Gagnon's attorney continued to maintain that Google+ auto-violated the restraining order. The judge countered by expressing his doubt of Gagnon's ability to follow court orders, suggesting something went a bit off the rails during the original hearing.

Whether or not Google+ attempted to widen Gagnon's social circle by including a woman who had taken out a restraining order against him is still unclear. What's perfectly clear, however, is that the situation behind Gagnon's current legal problems escalated very quickly.

On Friday, Gagnon gave his momentary fiancée a $4,000 engagement ring. The next day (Saturday) she broke up with him. By Monday, she had taken out a restraining order. By Thursday, Gagnon was back facing the judge after his allegedly inadvertently "mailing out" a Google+ invitation to his ex. (This itself was the result of some speedy escalation. Gagnon's ex took a printout of the invitation to the police who had him in custody less than ninety minutes later.)

What could have provoked this expeditious onslaught of small, personal calamities? Details are sparse, but the article signs off with these lines.

It’s not clear from court papers whether the ring has been returned to Gagnon.

A status hearing in the case is set for Feb. 6.

If Gagnon wants to stay on the good side of the law, he should probably just unplug from the internet. Plenty of social media services mine contact lists and are more than happy to mass mail out invitations with a single click of the "accept" button.

Filed Under: automatic invites, google plus, restraining order

Gov't Contractor Uses Copyright, Fear Of Hackers To Get Restraining Order Against Open Source Developer

from the the-same-goddamn-hammers-used-every-time dept

A recent copyright infringement (+ "threat to national security") lawsuit filed by a government contractor against its former employee highlights two terms the government frequently fears: open source and hacking.

Open source software (especially free open source software) is often portrayed by government officials as inherently unsafe to deploy. If anyone can see the source code then surely anyone can exploit it, they state. This is institutional resistance is aided greatly by companies like Microsoft who would prefer to see lucrative software licensing contracts continue indefinitely. Not that "closed source" software is any more secure, as Microsoft itself (along with Adobe) can certainly attest. But that irrational fear remains, and greatly hinders the adoption of open source software by government agencies.

Hacking is another of the government's favorite boogeymen. The oft-abused CFAA has turned exploration of software and systems into a crime. The government uses the words "hacking" and "hacker" almost exclusively to denote criminal activities and criminals. This continues long after the words have entered the mainstream to reflect positive activities. (See also: the extremely popular Lifehacker website; any number of events with the word "-hack" appended that result in extremely constructive outcomes.)

Andreas Schou brought this restraining order granted by an Idaho judge to many people's attention on Google+. (H/T to unnamed Techdirt reader for the submission.) It's an ultra-rare "no notice" restraining order that resulted from a wholly ex parte process involving only the plaintiff, government contractor Battelle Energy Alliance. The restraining order allowed Battelle to seize its former employee's computer, as well as prevent him from releasing the allegedly copied software as open source.

Schou details how he heard about the case.

Yesterday afternoon, my good friend (and former client) got a panicked call from his wife. Attorneys for the government contractor he formerly worked for had showed up at his door with some sort of order, demanding to be let in to seize his computers. While his wife was held out on the lawn by private attorneys, the contractor's counsel tried to call in the sheriff to -- I guess -- break down his door.

My first thought, obviously, was: this is all some sort of misunderstanding. Because Corey [Thuen] -- who's a professional security researcher -- has worked for the government his entire career, both at the FBI and as a security researcher specializing in SCADA systems, cyberterrorism, and critical infrastructure. He's a straight-laced, church-attending guy with three kids and an admittedly strange job.

And here's what he's been accused of: threatening national security by open-sourcing a network visualization and whitelisting tool.

The arguments made in Battelle's original complaint were bought almost in their entirety by Judge B. Lynn Winmill. Battelle claims copyright infringement, citing Corey Thuen's software, Visdom, resembles its own Sophia software. As evidence of this, it offers the following:

- Thuen worked on Sophia and had access to the code.
- Visdom's name is remarkably similar to Sophia. (The short version: Sophia is the goddess of wisdom. Wisdom/VISDOM.)
- There's no way Thuen could have come up with his own program in such a short period of time without copying substantial amounts of Sophia's code.

Battelle also points out that Thuen's company, Southfork, made a bid to license Sophia but withdrew it a short while later, inferring that Thuen's allegedly infringing copy made licensing software an unneeded expense. (Thuen's response claims that Southfork withdrew its bid when it became apparent Battelle wasn't interested in pursuing an open source option.)

Schou points out that if Battelle had done any due diligence, it would have realized that its infringement claim -- especially the claim that Thuen couldn't have created competing software in that time frame without copying Sophia -- is just plain wrong.

Somehow, despite spending a great deal of money on a BigLaw firm and getting an unprecedented ex parte order for the seizure of critical business infrastructure, they didn't check Github. And if they had, they'd have found out that the open-source project is built in a different language, using open libraries. They'd have been able to check the code commits to look at the period the software was written in.

And they wouldn't have sued to begin with.

Thuen breaks it down even more simply in his response:

Visdom, unlike Sophia, makes heavy use of third party open source libraries to accomplish many of the tasks for which the Sophia development team had to write code ourselves. An example for illustration: as part of my work on Sophia, I created a scrollbar from scratch, which means I had to implement the click and drag behavior (along with buttons) that causes a scrollbar to do what the average user expects a scrollbar to do. Visdom, on the other hand, builds on top of other, third party components that make scrollbars inherent. In other words, on Sophia development I spent significant time creating basic components to a user interface, whereas Visdom did not require such efforts. Visdom's heavy use of open source libraries facilitated its development in a matter of several months.

As Schou states, it's also written in a completely different coding language. Battelle and its representation may think it's just a simple copy-paste job to "port" software from one language to another, but Thuen dismantles this misperception.

Visdom was written in HTML, Javascript, and Go. As previously mentioned, Sophia was written in C. Visdom is not a translation of Sophia from C to the languages in which Visdom is written. We did not have the Sophia code when we created Visdom.

Further, a program written in one programming language cannot be cut-and-pasted into another programming language. Programming languages have different lexicographical grammars. As an example, if I'm writing code in C I have to deal with memory management; I have to keep track of the resources used by my programs. Javascript has no such concept, and any C code that does these functions would be impossible to translate into Javascript. Further, Javascript is an interpreted language and C is a compiled language. In other words, C creates software that runs on hardware, whereas Javascript creates software that runs in programs that run on hardware.

No two programmers who translate from one language to another, or from C to Javascript in particular, would produce the same output for any complex program. Those two languages, and their paradigms, are incompatible. A program written in C will inherently solve the problem to which it is directed in a different way than a program directed at the same problem but written in Javascript.

In developing Visdom, I specifically avoided any code, modules, sequences, routines, structures, screenshots, or any other materials that may have constituted some part of Sophia, based on my knowledge of Sophia as of the end of my access to it on or about August 2, 2012. Visdom is intended to solve the same problems as Sophia, but it is not a copy of Sophia, just as an electric car is not a copy of a gas-powered car simply because both are used for the same purpose.

What the judge determined to be "adequate circumstantial evidence" to justify ordering a no-notice restraining order (which included the seizure of Thuen's computer -- because he's a "hacker" -- more on that in a bit) completely falls apart when confronted with technical knowledge and observable facts.

Thuen's project is still listed at github where anyone can view related information, including development time, commits and, most importantly, the source code itself, where anyone with the technical knowledge would have seen that a) it pulled from other sources to speed production and b) is written in a completely different language.

Unfortunately, Battelle also abused the term "hacking" to justify the seizure of Thuen's computer without notice. Its arguments in the original complaint quotes one of its own employees in support of its "if we notify him, he'll just wipe the hard drive" theory. The court cites this in its justification of the ex parte restraining order

[B]attelle asserts that defendants are likely to wipe the hard drives on Thuen's computer, thus destroying direct evidence of wrongdoing. Battelle suggests that either of these actions would render further prosecution of the lawsuit fruitless...

The Court finds it significant that defendants are self-described hackers, who say, "We like hacking things and we don't want to stop."

A well-known characteristic of hackers is that they cover their tracks… This makes it likely that defendant Thuen will delete material on the hard drive of his computer that could be relevant to this case...

The Court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy, as the discussion of the case law above demonstrates. The tipping point for the Court comes from evidence that the defendants - in their own words - are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. And concealment likely involves the destruction of evidence on the hard drive of Thuen's computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

The supposedly damning declaration by Thuen comes from Southfork's home page.

We're pretty good at hacking things. The idea is:

Identify what you want looked at
We hack it
You fix it

Your customers love you and you gain a little bit more peace of mind. We wouldn't mind bringing your people in to participate and see first-hand how an attacker views your system. We'd love to train ourselves out of a job.

Southfork will test system security when hired by a company specifically for that purpose. Battelle's filing attempts to spin Southfork's technical knowledge into a purely evil thing. According to Battelle, hackers are always adversaries, even when the company's own front page statement proclaims otherwise. Just because the knowledge is there doesn't mean it will only be deployed to cause damage. Thuen's response points out the flaw in this reasoning.

As a cybersecurity professional, I am aware of, and possess ability for, many “hacking” techniques that may be used in illegal ways, but I put them to use improving my customers’ security. In other words, I’m much like a locksmith who possesses the ability to pick a lock and uses his knowledge to help as a contributing member of society… In my career, I have held government clearances with the Federal Bureau of Investigation and the United States Department of Energy, which required me to pass multiple lie detector tests, psychological tests, extensive background checks, and other miscellaneous tests.

Battelle's goes even further than this in its complaint, painting Thuen's hacking ability and his "threat" to take his project open source as a danger to national security.

BEA's copyrighted software is called Sophia and protects the United States' energy infrastructure by alerting utility administrators of potential hackers or other threats to the integrity of the nation's energy grid.

Given the nature of Sophia, Defendants' actions have implications for our national security. Defendants know of these implications but have ignored them.

Fortunately, this stretched argument doesn't weigh in the judge's restraining order, but it's still a part of Battelle's complaint against Thuen. This argument is baseless as well, relying heavily on the allegation that Thuen's code is Battelle's code. Theun points out the flaw in Battelle's portrayal of open source code as inherently dangerous.

I disagree with Battelle that security software like Sophia or Visdom cannot be open source because then hackers would have access to the source code. Security systems are better served by being open source so that complicated things, like cryptographic algorithms and implementations, can be reviewed by independent expert auditors rather than sitting behind smoke screens. The plethora of open source software used in secure systems today completely debunks the notion that you cannot have valuable and secure software that is also open source…

In the statements dealing with irreparable harm, Battelle claims it wouldn't be able to compete with Southfork's Visdom if Thuen chose to give it away (earning money from support packages and custom modules). Clearly, Battelle and its lawyers are unaware that top selling programs like Microsoft Office (LibreOffice) and Photoshop (GIMP) compete with fully-featured (and open source) free programs all the time.

There are many more flawed arguments in Battelle's filing, but it appears that both the plaintiff and the presiding judge had just enough knowledge between them to reach a bad conclusion. Thuen's response tackles every accusation from Battelle's complaint, punching some big holes in its filing. Unfortunately, the court decided to handle this ex parte and is only now aware of the weaknesses of Battelle's allegations.

What this looks like is a government contractor hoping to shut down a competitor by deploying two "chilling" favorites: copyright infringement and "threats to national security." It also hurts itself by falling for government FUD -- "open source is dangerous" and "hackers are bad" -- both of which contributed to the general level of failure contained in its complaint.

Filed Under: copyright, corey thuen, hackers, open source, restraining order, sophia, visdom
Companies: battelle, battelle energy alliance